Overview

overview

10

Static

static

3

JaffaCakes...eb.exe

windows7-x64

10

JaffaCakes...eb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_359bdfcac94bfd08c257944d2e80e5eb

  • Size

    848KB

  • Sample

    250301-a3fmrsvl13

  • MD5

    359bdfcac94bfd08c257944d2e80e5eb

  • SHA1

    2fb0f24a610d87c52572a6b33be08b36146ebabe

  • SHA256

    60c4fb7643bd98f6d1cab3582648315405d0531e7822a6e8848228be5b9770aa

  • SHA512

    5fb7d102511033c95a9e7dbb0e816667834451e0dada948d7dba66acaa3ee0fb27ee09a6f8a399251c9f0d8c84bdfba7962472c783a82d1f76fb9ec61aaaaae7

  • SSDEEP

    12288:F3KC9y7RGO1s4JTOnLK5yqbW+zaWJGHi+Q1aBNk8mzJqWLBHW2HdF7L7fd1qS+xi:PEELEbVaSJHWedF7vdJBmO

Score
10/10
blackshadesdefense_evasiondiscoverypersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_359bdfcac94bfd08c257944d2e80e5eb

    • Size

      848KB

    • MD5

      359bdfcac94bfd08c257944d2e80e5eb

    • SHA1

      2fb0f24a610d87c52572a6b33be08b36146ebabe

    • SHA256

      60c4fb7643bd98f6d1cab3582648315405d0531e7822a6e8848228be5b9770aa

    • SHA512

      5fb7d102511033c95a9e7dbb0e816667834451e0dada948d7dba66acaa3ee0fb27ee09a6f8a399251c9f0d8c84bdfba7962472c783a82d1f76fb9ec61aaaaae7

    • SSDEEP

      12288:F3KC9y7RGO1s4JTOnLK5yqbW+zaWJGHi+Q1aBNk8mzJqWLBHW2HdF7L7fd1qS+xi:PEELEbVaSJHWedF7vdJBmO

    Score
    10/10
    blackshadesdefense_evasiondiscoverypersistencerat

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

      ratblackshades

    • Blackshades family

      blackshades

    • Blackshades payload

    • Modifies firewall policy service

      defense_evasion

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks